endpoint-software-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Google Chrome fixes WebRTC use-after-free flaws enabling sandboxed code execution

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 29, 2026

Google disclosed two high-severity Chrome vulnerabilities in WebRTC, tracked as CVE-2026-7336 and CVE-2026-7341, that affect versions prior to 147.0.7727.138. Both bugs are classified as CWE-416 use-after-free issues and can be triggered when a user loads a crafted HTML page, allowing a remote attacker to achieve arbitrary code execution inside the browser sandbox.

The CVE records link the flaws to Chrome release notes and Chromium issue tracker entries, and both were published by Google's Chrome security team before receiving updates with CVSS details. CVE-2026-7336 was assigned a high-severity CVSS v3.1 rating reflecting impacts to confidentiality, integrity, and availability, while CVE-2026-7341 was later updated to clarify that exploitation requires user interaction, correcting an earlier scoring entry while preserving its overall high-impact assessment.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Apr 28, 2026 – Apr 29, 2026

Apr 29, 20266mo ago
CVE-2026-7341 CVSS vector corrected to require user interaction
On April 29, 2026, the CVE-2026-7341 record was modified to change its CVSS v3.1 vector from no user interaction required to user interaction required. The update preserved the overall high-impact assessment and reflected a temporary addition and later removal of the earlier vector entry.
Apr 29, 20266mo ago
CVE-2026-7336 record updated with CVSS details
On April 29, 2026, the CVE-2026-7336 record was updated to add CVSS v3.1 scoring information while retaining its classification as a high-severity CWE-416 use-after-free issue. References to the Chrome Releases blog and Chromium issue tracker were included.
Apr 28, 20266mo ago
Google publishes Chrome CVEs for two WebRTC use-after-free flaws
On April 28, 2026, CVE-2026-7336 and CVE-2026-7341 were published for use-after-free vulnerabilities in Google Chrome's WebRTC component. The flaws affect Chrome versions prior to 147.0.7727.138 and could allow remote code execution in the browser sandbox via a crafted HTML page.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Sandboxed code execution through WebRTC use-after-free in Google Chrome (CVE-2026-7341)Sandboxed code execution in Google Chrome WebRTC (CVE-2026-7336)

Organizations

1 linked

Google

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 28, 2026

CVE-2026-7336 - Google Chrome WebRTC Use-After-Free Arbitrary Code ExecutionOpen source ↗

Cvefeed High SeverityAdvisories · Apr 28, 2026

CVE-2026-7341 - Google Chrome WebRTC Use-After-Free VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Google Chrome fixes WebRTC use-after-free flaws enabling sandboxed code execution

How this story unfolded

CVE-2026-7341 CVSS vector corrected to require user interaction

CVE-2026-7336 record updated with CVSS details

Google publishes Chrome CVEs for two WebRTC use-after-free flaws

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Google Chrome fixes three use-after-free flaws enabling code execution and sandbox escape

Google Chrome fixes sandbox escape use-after-free flaws in Video and Graphite

Google Chrome fixes high-severity use-after-free flaws in Forms and FileSystem

Google Chrome fixes WebRTC use-after-free flaws enabling sandboxed code execution

How this story unfolded

CVE-2026-7341 CVSS vector corrected to require user interaction

CVE-2026-7336 record updated with CVSS details

Google publishes Chrome CVEs for two WebRTC use-after-free flaws

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Google Chrome fixes three use-after-free flaws enabling code execution and sandbox escape

Google Chrome fixes sandbox escape use-after-free flaws in Video and Graphite

Google Chrome fixes high-severity use-after-free flaws in Forms and FileSystem